> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hookmyapp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable or disable comments on media (API key)

> Enable or disable comments on an Instagram media object with your
`hmok_` API key. Delivery is at-least-once: do not retry a request
whose response you did not receive without checking the media's
state first.


Use `Authorization: Bearer hmok_...` (an API key, or a dashboard session) instead of a channel token. Accepted scope is `channel.manage`.

Delivery is at-least-once: don't automatically retry after an ambiguous failure (timeout, dropped connection). Check the media's current comment setting first to see whether it already changed.

If you need the raw Graph request, see the [`hmat_` gateway twin](/instagram/api/comments/hide-comment).


## OpenAPI

````yaml api-reference/openapi.yaml PATCH /channels/{ch}/instagram/media/{mediaId}
openapi: 3.1.0
info:
  title: HookMyApp API
  version: 1.0.0
  description: >
    The HookMyApp REST API. Everything the dashboard and the CLI can do, your

    code and your AI agents can do too.


    ## Authentication


    Two kinds of Bearer credentials exist. Do not mix them up:


    - **API key (`hmok_...`)** authenticates *you* (or your agent) to
      `https://api.hookmyapp.com`.
      Create one in the dashboard under **Org → API keys → Create API Key**
      (full org access, optional expiration date, reveal or
      revoke it any time from that page), or without a
      browser via the [agent auth flow](#tag/agent-auth) described in
      [`GET /auth.md`](https://api.hookmyapp.com/auth.md). That flow can mint a
      scope-limited key. Send it as `Authorization: Bearer hmok_...`, or on
      `/mcp` as `X-API-Key: hmok_...`. Use it for org, workspace, customer,
      channel and webhook management.
    - **Channel token (`hmat_...`)** sends messages, replies to comments, and
      publishes from one connected channel.
      Mint it with `GET /meta/channels/{id}/token`. It is not valid on
      `https://api.hookmyapp.com`.
      The same sends, replies and publishing are also available with the API key under
      `/channels/{ch}` (see the Channel actions tag).

    Browser sessions from the dashboard use the same endpoints with a session

    cookie or WorkOS JWT instead of `hmok_`.


    ## IDs


    Every ID on the wire is a typed public ID, never an internal UUID:

    `ws_` workspace/customer, `ch_` channel, `org_` organization,

    `cred_` connection credential, `ac_` agent credential.


    ## Workspace context


    Workspace-scoped routes (channels, webhook config, and deliveries) resolve
    the

    workspace from the `X-Workspace-Id: ws_XXXXXXXX` header.


    ## Errors


    Errors return a stable machine-readable `code` plus a human `message`.

    Agent tokens that exceed their granted scopes get `403
    AGENT_SCOPE_INSUFFICIENT`.


    ## Webhook signatures


    Deliveries to your webhook are signed with `X-HookMyApp-Signature-256`,

    an HMAC-SHA256 of the raw body keyed on the channel `WEBHOOK_HMAC_SECRET`.

    The Verify Token is a separate value used only for the GET ownership probe.
servers:
  - url: https://api.hookmyapp.com
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Agent auth
    description: Register an agent credential (`hmok_`) with email OTP, no browser needed
  - name: Organizations
    description: Your organization and its summary
  - name: Customers
    description: Customer workspaces you run messaging for (SaaS Mode)
  - name: Onboarding links
    description: Links your customers open to connect their own channels
  - name: Workspaces
    description: Team workspaces
  - name: Channels
    description: Connected WhatsApp and Instagram channels, and their channel tokens
  - name: Webhook config
    description: Where inbound events are delivered for a channel
  - name: Deliveries
    description: Inspect inbound delivery logs and app responses
  - name: Channel actions
    description: >-
      Send, reply, moderate and publish on a channel with the API key; the
      channel token stays server-side
paths:
  /channels/{ch}/instagram/media/{mediaId}:
    patch:
      tags:
        - Channel actions
      summary: Enable or disable comments on media (API key)
      description: |
        Enable or disable comments on an Instagram media object with your
        `hmok_` API key. Delivery is at-least-once: do not retry a request
        whose response you did not receive without checking the media's
        state first.
      operationId: setInstagramMediaComments
      parameters:
        - name: ch
          in: path
          required: true
          schema:
            type: string
          description: ch_ channel id
        - name: mediaId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - commentsEnabled
              properties:
                commentsEnabled:
                  type: boolean
      responses:
        '200':
          description: Moderated
          content:
            application/json:
              schema:
                type: object
                required:
                  - channelId
                  - action
                  - targetId
                  - success
                properties:
                  channelId:
                    type: string
                  action:
                    type: string
                  targetId:
                    type: string
                  success:
                    type: boolean
        '400':
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Error'
        '403':
          $ref: '#/components/responses/Error'
        '404':
          $ref: '#/components/responses/Error'
components:
  responses:
    Error:
      description: Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      properties:
        statusCode:
          type: integer
          example: 403
          description: HTTP status code
          mirrors the response status: null
        code:
          type: string
          description: Stable machine-readable code, e.g. `AGENT_SCOPE_INSUFFICIENT`
        message:
          type: string
        requestId:
          type: string
          description: Include this when contacting support about the request
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: '`Authorization: Bearer hmok_...` API key or a dashboard session token'

````